diff --git a/src/Tgstation.Server.Host/Components/Repository/ICredentialsProvider.cs b/src/Tgstation.Server.Host/Components/Repository/ICredentialsProvider.cs
index 3568f0747e..cef08354c6 100644
--- a/src/Tgstation.Server.Host/Components/Repository/ICredentialsProvider.cs
+++ b/src/Tgstation.Server.Host/Components/Repository/ICredentialsProvider.cs
@@ -1,4 +1,7 @@
-using LibGit2Sharp.Handlers;
+using LibGit2Sharp;
+using LibGit2Sharp.Handlers;
+
+using Tgstation.Server.Host.Jobs;
 
 namespace Tgstation.Server.Host.Components.Repository
 {
@@ -14,5 +17,11 @@ namespace Tgstation.Server.Host.Components.Repository
 		/// <param name="password">The optional password to use in the <see cref="CredentialsHandler"/>.</param>
 		/// <returns>A new <see cref="CredentialsHandler"/>.</returns>
 		CredentialsHandler GenerateCredentialsHandler(string username, string password);
+
+		/// <summary>
+		/// Rethrow the authentication failure message as a <see cref="JobException"/> if it is one.
+		/// </summary>
+		/// <param name="exception">The current <see cref="LibGit2SharpException"/>.</param>
+		public void CheckBadCredentialsException(LibGit2SharpException exception);
 	}
 }
diff --git a/src/Tgstation.Server.Host/Components/Repository/LibGit2RepositoryFactory.cs b/src/Tgstation.Server.Host/Components/Repository/LibGit2RepositoryFactory.cs
index 1dda89d84d..2c26a74fcf 100644
--- a/src/Tgstation.Server.Host/Components/Repository/LibGit2RepositoryFactory.cs
+++ b/src/Tgstation.Server.Host/Components/Repository/LibGit2RepositoryFactory.cs
@@ -71,6 +71,11 @@ namespace Tgstation.Server.Host.Components.Repository
 					logger.LogTrace(ex, "Suppressing clone cancellation exception");
 					cancellationToken.ThrowIfCancellationRequested();
 				}
+				catch (LibGit2SharpException ex)
+				{
+					CheckBadCredentialsException(ex);
+					throw;
+				}
 			},
 			cancellationToken,
 			DefaultIOManager.BlockingTaskCreationOptions,
@@ -99,5 +104,22 @@ namespace Tgstation.Server.Host.Components.Repository
 
 			throw new JobException(ErrorCode.RepoCannotAuthenticate);
 		};
+
+		/// <inheritdoc />
+		public void CheckBadCredentialsException(LibGit2SharpException exception)
+		{
+			if (exception == null)
+				throw new ArgumentNullException(nameof(exception));
+
+			if (exception.Message == "too many redirects or authentication replays")
+				throw new JobException("Bad git credentials exchange!", exception);
+
+			if (exception.Message == ErrorCode.RepoCredentialsRequired.Describe())
+				throw new JobException(ErrorCode.RepoCredentialsRequired);
+
+			// submodule recursion
+			if (exception.InnerException is LibGit2SharpException innerException)
+				CheckBadCredentialsException(innerException);
+		}
 	}
 }
diff --git a/src/Tgstation.Server.Host/Components/Repository/Repository.cs b/src/Tgstation.Server.Host/Components/Repository/Repository.cs
index 0ebddb2640..452418ce5f 100644
--- a/src/Tgstation.Server.Host/Components/Repository/Repository.cs
+++ b/src/Tgstation.Server.Host/Components/Repository/Repository.cs
@@ -111,19 +111,6 @@ namespace Tgstation.Server.Host.Components.Repository
 		/// </summary>
 		bool disposed;
 
-		/// <summary>
-		/// Rethrow the authentication failure message as a <see cref="JobException"/> if it is one.
-		/// </summary>
-		/// <param name="exception">The current <see cref="LibGit2SharpException"/>.</param>
-		static void CheckBadCredentialsException(LibGit2SharpException exception)
-		{
-			if (exception.Message == "too many redirects or authentication replays")
-				throw new JobException("Bad git credentials exchange!", exception);
-
-			if (exception.Message == ErrorCode.RepoCredentialsRequired.Describe())
-				throw new JobException(ErrorCode.RepoCredentialsRequired);
-		}
-
 		/// <summary>
 		/// Initializes a new instance of the <see cref="Repository"/> class.
 		/// </summary>
@@ -262,7 +249,7 @@ namespace Tgstation.Server.Host.Components.Repository
 						}
 						catch (LibGit2SharpException ex)
 						{
-							CheckBadCredentialsException(ex);
+							credentialsProvider.CheckBadCredentialsException(ex);
 						}
 
 						cancellationToken.ThrowIfCancellationRequested();
@@ -439,7 +426,7 @@ namespace Tgstation.Server.Host.Components.Repository
 					}
 					catch (LibGit2SharpException ex)
 					{
-						CheckBadCredentialsException(ex);
+						credentialsProvider.CheckBadCredentialsException(ex);
 					}
 				},
 				cancellationToken,
@@ -982,7 +969,7 @@ namespace Tgstation.Server.Host.Components.Repository
 				{
 					// workaround for https://github.com/libgit2/libgit2/issues/3820
 					// kill off the modules/ folder in .git and try again
-					CheckBadCredentialsException(ex);
+					credentialsProvider.CheckBadCredentialsException(ex);
 					logger.LogWarning(ex, "Initial update of submodule {0} failed. Deleting submodule directories and re-attempting...", submodule.Name);
 
 					await Task.WhenAll(
@@ -1001,7 +988,7 @@ namespace Tgstation.Server.Host.Components.Repository
 					}
 					catch (LibGit2SharpException ex2)
 					{
-						CheckBadCredentialsException(ex2);
+						credentialsProvider.CheckBadCredentialsException(ex2);
 						logger.LogTrace(ex2, "Retried update of submodule {0} failed!", submodule.Name);
 						throw new AggregateException(ex, ex2);
 					}
diff --git a/src/Tgstation.Server.Host/Components/Repository/RepositoryManager.cs b/src/Tgstation.Server.Host/Components/Repository/RepositoryManager.cs
index 41cd9eb7b7..bb424f25f4 100644
--- a/src/Tgstation.Server.Host/Components/Repository/RepositoryManager.cs
+++ b/src/Tgstation.Server.Host/Components/Repository/RepositoryManager.cs
@@ -153,7 +153,7 @@ namespace Tgstation.Server.Host.Components.Repository
 								cancellationToken)
 								.ConfigureAwait(false);
 						}
-						catch
+						catch (Exception ex)
 						{
 							try
 							{
@@ -162,9 +162,9 @@ namespace Tgstation.Server.Host.Components.Repository
 								// DCT: Cancellation token is for job, operation must run regardless
 								await ioManager.DeleteDirectory(repositoryPath, default).ConfigureAwait(false);
 							}
-							catch (Exception e)
+							catch (Exception innerException)
 							{
-								logger.LogDebug(e, "Error deleting partially cloned repository!");
+								logger.LogError(innerException, "Error deleting partially cloned repository!");
 							}
 
 							throw;